Legal

Privacy Policy

Last updated: June 2026

Who we are

OSSE Lab Pty Ltd ("OSSE Lab", "we", "us") operates the OSSE Lab mobile application and the osselab.com website. We are based in Australia and subject to the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs).

For privacy-related enquiries, contact us at hello@osselab.com.

What we collect

We collect only what is necessary to provide the OSSE Lab service:

• Account information: your email address and first name.
• Age group: you select your age group at sign-up; under-18s cannot proceed and nothing is retained. We record the age group you selected and a yes/no confirmation that you are 18 or older. We never ask for, collect, or store your date of birth.
• Scan scores: twelve numerical scores derived from your face scan (hydration, texture, pigmentation, etc.) and your overall OSSE index. These are numbers only — not images.
• Skin type: a categorical classification (e.g. Normal, Oily, Combination) derived from your scan.
• Health profile flags: whether you are pregnant, breastfeeding, or using prescription skincare. We store boolean flags only — no medical records.
• Protocol and outcome data: the products recommended to you, your purchase interactions, and your Day 30 rescan results. This data is de-identified and forms the OSSE Lab outcome dataset.
• Device and usage data: device type, operating system, app version, and push notification preferences.
• Location: approximate location (rounded to roughly 11 km) captured at scan time and, if you allow it, updated for local UV alerts. Used solely to resolve your local UV index. Never precise, never shared.

Your face image

Your face image is processed solely to generate your skin scores. It is deleted from OSSE Lab's systems immediately after your scores are returned — we do not store, cache, or retain your image beyond the analysis round trip.

Image analysis is performed by Perfect Corp (Taiwan), our skin analysis processing partner. Images submitted to Perfect Corp are not routinely accessed by their personnel. In the event of a reported technical issue, authorised Perfect Corp personnel may access your image solely to diagnose and resolve the issue. Any copies used for this purpose are deleted once the investigation is complete. Images are automatically deleted from Perfect Corp's servers within 30 days of submission.

Perfect Corp does not use your image for model training, quality assurance, product improvement, or any purpose other than processing your specific analysis request. They do not share biometric information with third parties.

How we use your data

• To deliver your skin audit report and product protocol.
• To send you protocol check-ins and rescan reminders at times you choose.
• To build, retain, and commercialise the OSSE Lab outcome dataset: de-identified scan scores, protocol, and outcome data — our core research asset. This may include licensing or selling the de-identified dataset.
• To improve the OSSE Lab service over time.

We do not sell your personal information. We do not use your data for advertising. We do not share your personal information with third parties except as described in this policy.

Separately: de-identified data — scores and outcomes with every trace of who you are permanently removed, which is no longer personal information — forms the OSSE Lab outcome dataset. We may use, license, or sell that de-identified dataset for research and commercial purposes.

De-identification

De-identified means genuinely non-re-identifiable: we permanently remove every identifier and every link between you and your scores. We will never attempt to re-identify de-identified data, and any recipient of the dataset is contractually prohibited from attempting re-identification.

Business transfers

If OSSE Lab is ever involved in a merger, acquisition, sale of assets, or corporate restructure, your personal information and the de-identified outcome dataset may be transferred to the successor entity so the service and the science can continue. The successor must handle your information under terms at least as protective as this policy. We will notify you of any such change through the app or by email.

Retail partners

When you tap a product recommendation, you are taken to one of our retail partners (Adore Beauty, Sephora AU, Chemist Direct, or Mecca). These retailers have their own privacy policies. Some of these links are affiliate links — OSSE Lab receives a commission from some retailers if you purchase. We never receive your payment details or order contents.

Data retention and deletion

You can request deletion of your account at any time from within the app. When you delete your account, your personal information is permanently removed. Your de-identified scan scores may be retained as part of the OSSE Lab outcome dataset, with no path back to you as an individual.

Overseas disclosure

Your face image is processed by Perfect Corp, whose servers are located in Taiwan. By using OSSE Lab, you consent to this overseas processing. Perfect Corp handles your data in accordance with their privacy policy, available at perfectcorp.com/business/privacy.

Your rights and withdrawing consent

Under the Australian Privacy Act, you have the right to access the personal information we hold about you and to request corrections. To exercise these rights, contact us at hello@osselab.com.

You can withdraw your consent at any time — withdrawing is as easy as giving it. Delete your account in the app or email us. After withdrawal we stop collecting your data and permanently remove your personal information. De-identified data already in the dataset has no link back to you, so it cannot be found, retrieved, or deleted — this is explained before your first scan.

Changes to this policy

We may update this policy from time to time. We will notify you of material changes through the app or by email. The current version is always available at osselab.com/privacy.html.